Reliable detection of LSB steganography in color and grayscale images

ABSTRACT

A system and method that efficiently, accurately, and simply detect reliably least-significant-bit (“LSB”) embedding of a secret message in randomly scattered pixels. The system and method apply to both 24-bit color images and 8-bit grayscale or color images. Many commercial steganographic programs use Least Significant Bit embedding (LSB) as the method of choice to hide messages in 24-bit, 8-bit color images and in grayscale images. They do so based on the common belief that changes to the LSBs of colors cannot be detected because of noise that is always present in digital images. By inspecting the differences in capacity for lossless (invertible) embedding in the LSB and the shifted LSB plane, the present invention reliably detects messages as short as 1% of the total number of pixels (assuming 1 bit per sample). The system and method of the present invention are fast, and they provide accurate estimates for the length of the embedded secret message.

STATEMENT OF GOVERNMENT INTEREST

This invention was made with Government support under F30602-00-1-0521and F49620-01-1-0123 from the U.S. Air Force. The Government has certainrights in the invention.

BACKGROUND OF THE INVENTION

This invention relates to steganography. Steganography is the art ofsecret communication, whose purpose is to hide the very presence of acommunication. In particular this invention relates to the detection ofhidden messages.

Steganography differs from cryptography, whose goal is to makecommunication unintelligible to those who do not posses the right keys.By means of steganography, digital images, videos, sound files, andother computer files that contain perceptually irrelevant or redundantinformation can be used as covers, that is, as carriers that hide secretmessages embedded within. If one embeds a secret message into acover-image, one obtains a “stego-image.”

The stego-image cannot contain any detectable artifacts that result fromembedding the secret message. If it does, a third party can use suchartifacts to determine that a secret message lies within thestego-image. Once the third party can reliably detect the presence ofthe secret message, the steganographic tool becomes useless.

Images stored in the JPEG format make very poor cover images forsteganographic methods that embed information in the spatial (pixel)domain. The quantization introduced by JPEG compression can serve as a“watermark” or unique fingerprint, and one can detect even very smallmodifications of the cover image by inspecting the compatibility of thestego-image with the JPEG format. (See J. Fridrich, M. Goljan, and R.Du, “Steganalysis based on JPEG compatibility”, SPIE Multimedia Systemsand Applications IV, Denver, Colo. (Aug. 20-24, 2001), to be presented).

Most steganographic programs use Least Significant Bit embedding (“LSB”)as the method of choice to hide a message in 24-bit and 8-bit colorimages, and in grayscale images. They do so because it is generallybelieved that changes to the LSBs of colors cannot be detected. Thenoise that is always present in digital images is thought to mask suchchanges.

The present inventors have developed a steganographic method to detectLSB embedding in 24-bit color images. (See J. Fridrich, R. Du, and L.Meng, “Steganalysis of LSB Encoding in Color Images”, ICME 2000, NewYork City, July 31-August 2, New York.) This RQP method is based onanalyzing close pairs of colors created by LSB embedding. It worksreasonably well as long as the number of unique colors in the coverimage is less than 30% of the number of pixels. The size of the secretmessage can be estimated only very roughly. The results becomeprogressively unreliable once the number of unique colors exceedsroughly 50% of the number of pixels, as happens frequently for highresolution raw scans and images taken with digital cameras stored in anuncompressed format. Another disadvantage of the RQP method is that itcannot be modified for grayscale images.

Westfeld and Pfitzmann (“Attacks on Steganographic Systems”, Proc.3^(rd) Info. Hiding Workshop, Dresden, Germany, Sep. 28-Oct. 1, 1999,pp. 61-75) introduced a method based on statistical analysis of Pairs ofValues (PoVs) that are exchanged during message embedding. These PoVscould be formed, for example, by pairs of colors that differ in the LSBonly. This method provides very reliable results when the message'splacement is known (e.g., when it is sequential). However, randomlyscattered messages can only be reliably detected with this method whenthe message length becomes comparable with the number of pixels in theimage.

Johnson and Jajodia (“Steganography: Seeing the Unseen.” IEEE Computer,February 1998, pp.26-34; “Steganalysis of Images Created Using CurrentSteganography Software.” Proceedings of Workshop on Information Hiding,Portland, Oreg., April 1998. Also published as Notes in ComputerScience, vol. 1525, Springer-Verlag, 1998) pointed out thatsteganographic methods for palette images that preprocess the palettecan be vulnerable. A number of steganographic programs create clustersof close palette colors that can be swapped for each other to embedmessage bits. This swapping can be done by decreasing the color depthand then expanding it to 256 by making small perturbations to thecolors. This preprocessing creates suspicious pairs (clusters) of colorsthat can be easily detected. However, steganographic techniques that donot modify the palette (e.g., those that hide messages by embedding LSBinto the pointers) cannot be detected by inspecting the palette itself.

Thus there is a need for reliable and accurate steganalytic techniquesthat can be applied to both 24-bit color images and to 8-bit grayscaleor color images with randomly scattered message bits embedded in theLSBs of colors or pointers to the palette.

OBJECTS AND SUMMARY OF THE INVENTION

An object of the present invention is to provide an efficient, accurate,and simple method to reliably detect LSB embedding.

A further object of the present invention is to provide such a method toreliably detect LSB embedding in randomly scattered pixels.

Still a further object of the present invention is to provide such amethod to reliably detect LSB embedding where the randomly scatteredpixels are in both 24-bit color images and 8-bit grayscale or colorimages.

Briefly stated, the present invention provides a system and a methodthat efficiently, accurately, and simply detect reliablyleast-significant-bit (“LSB”) embedding of a secret message in randomlyscattered pixels. The system and method apply to both 24-bit colorimages and 8-bit grayscale or color images. Many commercialsteganographic programs use Least Significant Bit embedding (LSB) as themethod of choice to hide messages in 24-bit, 8-bit color images and ingrayscale images. They do so based on the common belief that changes tothe LSBs of colors cannot be detected because of noise that is alwayspresent in digital images. By inspecting the differences in capacity forlossless (invertible) embedding in the LSB and the shifted LSB plane,the present invention reliably detects messages as short as 1% of thetotal number of pixels (assuming 1 bit per sample). The system andmethod of the present invention are fast, and they provide accurateestimates for the length of the embedded secret message.

According to an embodiment of the invention, a method for detectingleast significant bit (“LSB”) embedding of a message hidden in randomlyscattered samples of an alleged cover image comprises the steps of:

dividing the alleged cover image into a plurality of disjoint groups ofadjacent samples; defining a discrimination function that assigns a realnumber to each member of the plurality, thereby capturing the smoothnessof each of the groups; defining on the plurality at least one invertibleoperation that comprises a permutation of sample values, whereby valuesof the samples are invertibly perturbed by a small amount; applying thediscrimination function and the flipping operation to define in theplurality three types of sample groups, (R)egular, (S)ingular, and(U)nusable, each of the types being defined for both positive andnegative operations; plotting both positive and negative R and S for thealleged cover image on an RS diagram; constructing four curves of the RSdiagram and calculating their intersections by extrapolation; anddetermining the existence or nonexistence of a secret message from theintersections.

According to a feature of the invention, apparatus for detecting leastsignificant bit (“LSB”) embedding of a message hidden in randomlyscattered samples of an alleged cover image comprises means for dividingthe alleged cover image into a plurality of disjoint groups of adjacentsamples; first means for defining effective for defining adiscrimination function that assigns a real number to each member of theplurality, thereby capturing the smoothness of each of the groups;second means for defining effective for defining on the plurality atleast one invertible operation that comprises a permutation of samplevalues, whereby values of the samples are invertibly perturbed by asmall amount; means for applying the discrimination function and theflipping operation to define in the plurality three types of samplegroups, (R)egular, (S)ingular, and (U)nusable, each of the types beingdefined for both positive and negative operations; means for plottingboth positive and negative R and S for the alleged cover image on an RSdiagram; means for constructing four curves of the RS diagram; means forcalculating the intersections of the four curves by extrapolation; andfirst means for determining effective for determining from theintersections the existence or nonexistence of a secret message.

According to another feature of the invention, a computer-readablestorage medium embodies program instructions for a method for detectingleast significant bit (“LSB”) embedding of a message hidden in randomlyscattered samples of an alleged cover image, the method comprising thesteps of: dividing the alleged cover image into a plurality of disjointgroups of adjacent samples; defining a discrimination function thatassigns a real number to each member of the plurality, thereby capturingthe smoothness of each of the groups; defining on the plurality at leastone invertible operation that comprises a permutation of sample values,whereby values of the samples are invertibly perturbed by a smallamount; applying the discrimination function and the flipping operationto define in the plurality three types of sample groups, (R)egular,(S)ingular, and (U)nusable, each of the types being defined for bothpositive and negative operations; plotting both positive and negative Rand S for the alleged cover image on an RS diagram; constructing fourcurves of the RS diagram and calculating their intersections byextrapolation; and determining the existence or nonexistence of a secretmessage from the intersections.

The above, and other objects, features and advantages of the presentinvention will become apparent from the following description read inconjunction with the accompanying drawings, in which like referencenumerals designate the same elements.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram of an image taken by a digital camera in which theregular groups of pixels (R) and the singular groups (S) are plotted asfunctions of the number of flipped pixels.

FIG. 2 is a histogram of the initial bias (in percent of the totalnumber of pixels) in 331 original cover images, of size 250×350 pixels,stored in JPEG format.

FIG. 3 is a flow diagram showing the steps of an embodiment of theinvention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

In steganography, the less information embedded into the cover-image,the smaller the probability that embedding a secret image will introducedetectable artifacts. The selection of the cover-image, made by theperson who sends the message, also determines how readily the existenceof the secret message can be discovered. Images with a low number ofcolors, computer art, images with a unique semantic content, such asfonts—all should be avoided as cover images. Some steganographic expertssuggest that grayscale images make the best cover-images (see T. Aura,“Invisible communication”, In Proc. of the HUT Seminar on NetworkSecurity '95, Espoo, Finland, November 1995. Telecommunications Softwareand Multimedia Laboratory, Helsinki University of Technology[http://deadlock.hut.fi/ste/ste_html.html],[ftp://saturn.hut.fi/pub/aaura/ste1195.ps]).

Uncompressed scans of photographs, or images obtained with a digitalcamera, contain many colors. Thus they are usually considered safe forsteganography. However, the present invention can reliably detectmessages embedded in this class of images and accurately estimate themessage length. The novel steganalytic technique of the presentinvention, which detects LSB embedding in color and grayscale images,originates in analyzing the capacity for lossless data embedding in theLSBs. For most images, the LSB plane is essentially random; it does notcontain any easily recognizable structure. Thus classical statisticalquantities constrained to the LSB plane cannot reliably capture thedegree of randomization. Randomizing the LSBs decreases the losslesscapacity in the LSB plane. It has a completely different influence onthe capacity for embedding that is not constrained to one bit-plane.Thus the lossless capacity is a sensitive measure of the degree ofrandomization of the LSB plane.

The lossless capacity reflects the fact that the LSB plane, even thoughit looks random, is nevertheless related to the other bit-planes. Thisrelationship, however, is not linear but nonlinear, and the losslesscapacity measures this relationship. Thus it can be used to detectsteganography.

To explain the new steganalytic technique, we begin with the mainconcepts of lossless embedding. Assume a cover image with M×N pixels andpixel values from the set P. For example, for an 8-bit grayscale image,P={0, . . . , 255}. The lossless embedding starts with dividing theimage into disjoint groups of n adjacent pixels (x₁, . . . , x_(n)). Forexample, we can choose groups of n=4 consecutive pixels in a row. Wefurther define a discrimination function ƒ that assigns a real numberƒ(x₁, . . . , x_(n))ÎR to each pixel group G=(x₁, . . . , x_(n)). Thediscrimination function captures the smoothness or “regularity” of thegroup of pixels G. The noisier the group of pixels G=(x₁, . . . ,x_(n)), the larger the value of the discrimination function becomes. Forexample, we choose the ‘variation’ of the group of pixels (x₁, . . . ,x_(n)) as the discrimination function ƒ: $\begin{matrix}{{f\left( {x_{1},x_{2},\quad\ldots\quad,x_{n}} \right)} = {\sum\limits_{i = 1}^{n - 1}\quad{❘{{x_{i + 1} - x_{i}}❘}}}} & (1)\end{matrix}$We can design other discrimination functions based on models of orstatistical assumptions about the cover image.

Finally, we define an invertible operation F on P called “flipping”.Flipping will be a permutation of gray levels that consists entirely oftwo-cycles. Thus, F will have the property that F²=Identity or F(F(x))=xfor all xÎP. The permutation F₁: 0<<1, 2<<3, . . . , 254<<255corresponds to flipping (negating) the LSB of each gray level. Wefurther define shifted LSB flipping F⁻¹ as −1<<0, 1<<2, 3<<4, . . . ,253<<254, 255<<256, orF⁻¹(x)=F₁(x+1)−1 for all x.  (1a)For completeness, we also define F₀ as the identity permutation F(x)=xfor all xÎP. We use the discrimination function ƒ and the flippingoperation F to define three types of pixel groups: R, S, and U:

-   -   Regular groups: GÎRÛG∈R        ƒ(F(G))>ƒ(G)    -   Singular groups: GÎSÛG∈S        ƒ(F(G))<ƒ(G)    -   Unusable groups: GÎUÛG∈U        ƒ(F(G))=ƒ(G).        In the expressions above, F(G) means that the flipping function        F is applied to the components of the vector G=(x₁, . . . ,        x_(n)). We may wish to apply different flipping to different        pixels in the group G. The assignment of flipping to pixels can        be captured with a mask M, which is a n-tuple with values −1, 0,        and 1. The flipped group F(G) is defined as (F_(M(1))(x₁),        F_(M(2))(x₂), . . . , F_(M(n))(x_(n))). The purpose of the        flipping function F is to perturb the pixel values in an        invertible way by some small amount, thereby simulating the act        of invertibly adding noise. In typical pictures, adding a small        amount of noise (i.e., flipping by a small amount) will lead to        an increase rather than a decrease in the discrimination        function. Thus, the total number of regular groups will be        larger than the total number of singular groups. This bias        allows for lossless imperceptible embedding of a potentially        large amount of information (more details may be found in J.        Fridrich, M. Goljan, and R. Du, “Distortion-free Data        Embedding”, 4th Information Hiding Workshop, Pittsburgh, Pa.,        Apr. 25-27, 2001).

We denote the number of regular groups for mask M as R_(M) (in percentsof all groups). Similarly, S_(M) will denote the relative number ofsingular groups. We have R_(M)+S_(M)£1 and R_(−M)+S_(−M)£1, for thenegative mask. The statistical hypothesis of our steganalytic techniqueis that, in a typical image, the expected value of R_(M) is equal tothat of R_(−M), and the same is true for S_(M) and S_(−M):R_(M)@R_(−M) and S_(M)@S_(−M) R_(M) ≅R _(−M) and S _(M) ≅S _(−M)  (2)

This hypothesis can be justified heuristically by inspecting theexpression (1). The flipping operation F⁻¹ is the same as applying F₁ toan image whose colors have been shifted by one. For a typical image,there is no a priori reason why the number of R and S groups shouldchange significantly by shifting the colors by one.

Indeed, we have extensive experimental evidence, discussed below withreference to FIG. 2, that the hypothesis (2) holds very accurately forimages taken with a digital camera for both lossy and lossless formats.It also holds well for images processed with common image processingoperations and for most scanned images. The relationship (2), however,is violated if the LSB plane is randomized, for example, by LSBsteganography.

FIG. 1 shows an RS-diagram of an image taken by a digital camera. Thex-axis is the message length m, that is, the percentage of pixels withflipped LSBs. The y-axis is the relative number of regular and singulargroups with masks M and −M, where M=[0 1 1 0].

Referring to FIG. 1, randomizing the LSB plane forces the differencebetween R_(M) and S_(M) to zero as the length m of the embedded messageincreases. After flipping the LSB of 50% of pixels (which is what wouldhappen after embedding a random message bit into every pixel), we obtainR_(M)@S_(M) R_(M) ≅S _(M). This is equivalent to saying that thelossless embedding capacity in the LSB plane is zero (See Fridrich,Goljan, and Du, “Distortion-free Data Embedding”). What is surprising isthat randomizing the LSB plane has the opposite effect on R_(−M) andS_(−M). Their difference increases with the length m of the embeddedmessage. The RS diagram of FIG. 1 shows R_(M), S_(M), R_(−M), and S_(−M)as functions of the number of pixels with flipped LSBs.

A simple explanation of the peculiar increase in the difference betweenR_(−M) and S_(−M) is given for the mask M=[0 1 1 0]. We define setsC_(i)={2i, 2i+1}, i=0, . . . , 127, and cliques of groupsC_(rst)={G|GÎC_(r)′C_(s)′C_(t)} C_(rst) ={G|G∈C _(r) ′C _(s) ′C _(t)}.There are 128³ cliques, each clique consisting of 8 groups (triples).The cliques are closed under LSB randomization. For the purpose of ouranalysis, we recognize four different types of cliques, ignoring thosethat are horizontally and vertically symmetrical. The table below showsthe four types and the number of R, S, and U groups under F₁ and F⁻¹ foreach type. From the table, one can see that, while randomizing LSBstends to equalize the number of R and S groups in each clique under F₁,it increases the number of R groups and decreases the number of S groupsunder F⁻¹.

TABLE 1 Clique type F₁ flipping F⁻¹ flipping r = s = t 2R, 2S, 4U 8R r =s > t 2R, 2S, 4U 4R, 4U r < s > t 4R, 4S 4R, 4S r > s < t 8U 8U

The new steganalytic technique of the present invention, which we callthe RS technique, is to estimate the four curves of the RS diagram ofFIG. 1 and calculate their intersection by extrapolation. The generalshape of the four curves in the diagram varies with the cover-image fromalmost perfectly linear to curved. Our experiments show that the R_(−M)and S_(−M) curves are well-modeled with straight lines; the inner curvesR_(M) and S_(M) can be reasonably well approximated with second degreepolynomials.

The parameters of the curves can be determined from the points marked inFIG. 1. If we have a stego-image with a message of an unknown length p(in percent of pixels) embedded in the LSBs of randomly scatteredpixels, our initial measurements of the number of R and S groupscorrespond to the points R_(M)(p/2), S_(M)(p/2), R_(−M)(p/2), andS_(−M)(p/2) (see FIG. 1). The factor of one half comes from the factthat, if the message is a random bit-stream, on average only one half ofthe pixels will be flipped. If we flip the LSBs of all pixels in theimage and calculate the number of R and S groups, we will obtain thefour points R_(M)(1−p/2), S_(M)(1−p/2), R_(−M)(1−p/2), and S_(−M)(1−p/2)(see FIG. 1). By randomizing the LSB plane of the stego-image, we willobtain the middle points R_(M)(½) and S_(M)(½). Because these two pointsdepend on the particular randomization of the LSBs, we should repeat theprocess many times and estimate R_(M)(½) and S_(M)(½) from thestatistical samples. We can fit straight lines through the pointsR_(−M)(p/2) R_(−M)(1−p/2) and S_(−M)(p/2) S_(−M)(1−p/2). The pointsR_(M)(p/2), R_(M)(½), R_(M)(1−p/2), and S_(M)(p/2), S_(M)(½),S_(M)(1−p/2) determine two parabolas. Each parabola and a correspondingline intersect to the left. The arithmetic average of the x coordinatesof both intersections allows us to estimate the unknown message lengthp.

We can avoid the time-consuming statistical estimation of the middlepoints R_(M)(½) and S_(M)(½) and, at the same time, make the messagelength estimation much more elegant by making two additionalassumptions: (1) The point of intersection of the curves R_(M) andR_(−M) has the same x coordinate as the point of intersection of thecurves S_(M) and S_(−M). This is essentially a stronger version of theassumption embodied in equation 2 above. (2) The curves R_(M) and S_(M)intersect at m=50%, or R_(M)(½)=S_(M)(½). This assumption is equivalentto setting the lossless embedding capacity for a randomized LSB plane atzero.

We have verified these assumptions experimentally for a large databaseof images with unprocessed raw BMPs, JPEGs, and processed BMP images.From them we derive a simple formula for the secret message length p.After rescalingthe x axis so that p/2 becomes 0 and 100−p/2 becomes 1,the x-coordinate of the intersection point is a root of the followingquadratic equation:2(d₁+d₀)x²+(d⁻⁰−d⁻¹−d₁−3d₀)x+d₀−d⁻⁰=0,where d₀=R_(M)(p/2)−S_(M)(p/2), d₁=R_(M)(1−p/2)−S_(M)(1−p/2),d⁻⁰=R_(−M)(p/2)−S_(−M)(p/2), and d⁻¹=R_(−M)(1−p/2)−S_(−M)(1−p/2).

The message length p is calculated from the root x whose absolute valueis smaller,p=x/(x−½).

The straight lines are defined by the number of R and S groups at p/2and 1−p/2, and the assumptions embodied in equations (1) and (2) aboveprovide enough constraints to uniquely determine the parabolas and theirintersections.

Referring to FIG. 2, several factors influence the accuracy of theestimated message length. The first is initial bias. Random variationscan cause a cover image that contains no hidden message to indicate asmall message length. This initial non-zero bias could be both positiveand negative, and it puts a limit on the theoretical accuracy of thesteganalytic technique of the present invention. We have tested thisinitial bias for a database of 331 grayscale JPEG images, which yieldeda Gaussian distribution with a standard deviation of 0.5%, as shown inFIG. 2. Smaller images tend to have higher variation in the initial biasbecause they have a smaller number of R and S groups. Scans ofhalf-toned images and noisy images exhibit larger variations in the biasas well. On the other hand, the bias is typically very low for JPEGimages, uncompressed images obtained by a digital camera, and highresolution scans. As another rule of thumb, we have found that colorimages exhibit larger variation in the initial bias than grayscaleimages.

If the initial message length ml₀ can be estimated using other means,the following formula can be used to correct the detected message lengthml_(det) ${ml} = \frac{{ml}_{\det} - {ml}_{0}}{1 - {ml}_{0}}$

For very noisy images, the difference between the number of regular andsingular pixels in the cover image is small. Consequently, the lines inthe RS diagram intersect at a small angle and the accuracy of the RSSteganalysis of the present invention decreases.

The RS Steganalysis technique is more accurate for messages that arerandomly scattered in the stego-image than for messages concentrated ina localized area of the image. To address this issue, one can apply thesame algorithm to a sliding rectangular region of the image.

With a Kodak DC260 digital camera, we converted a color 1536×1024 imageto grayscale and down-sampled to 384×256 pixels. A series ofstego-images was created from the original image by randomizing the LSBsof 0-100% pixels in 5% increments. We detected the number of pixels withflipped LSBs in each stego-image using the steganalysis technique of thepresent invention and groups of 2×2 pixels with the mask [1 0; 0 1]. Theerror between the actual and estimated percentage of flipped pixels wasalmost always smaller than 1%.

Referring to FIG. 3, the method of the invention is shown. In step 40,the cover image is divided into a plurality of disjoint groups ofadjacent samples. The in step 42, a discrimination function is definedthat assigns a real number to each member of the disjoint groups,thereby capturing the smoothness of the groups. In step 44, at least oneinvertible operation is defined on the disjoint groups, with theinvertible operation including a permutation of a sample values, wherebyvalues of the samples are invertibly perturbed by a small amount. Instep 46, the discrimination function and the invertible operation areapplied to define in step 48 three types of sample groups in thedisjoint groups, i.e., (R)egular, (S)ingular, and (U)nusable, with eachof the types being defined for both positive and negative operations. Instep 50, both positive and negative R and S are plotted for the allegedcover image on an RS diagram, after which four curves of the RS diagramare constructed and their intersections are calculated by extrapolationin step 52. Finally, in step 54, the existence or nonexistence of asecret message is determined from the intersections.

The RS Steganalysis technique of the present invention is applicable tomost commercial steganographic software products. We have tested the RSsteganalytic technique on a small sample of images, processed withdifferent software products, and with different message sizes. In allcases, stego-images were readily distinguished from original coverimages, and the estimated message length was within a few percent of theactual message length. We believe that our technique is equallyapplicable to GIFs with randomly scattered messages.

We tested the performance of the RS Steganalysis technique of thepresent invention on two images obtained from steganographic softwareproducts currently on the market. We used a relatively small image witha short message. The first test image was a scanned color photograph422×296, and the message was a random bit sequence of length 375 kb, or20% of the full capacity of the image (100%=3 bpp). Since the initialbias is about 2.5% in each color channel (see Table 2), as indicated inthe first row of the table, the expected detected percentage of flippedpixels would be about 12.5%. The actual numbers that should be detectedin an ideal case (assuming zero bias) are indicated in parenthesis.

TABLE 2 Initial bias and estimated number of pixels with flipped LSBsfor the first test image Red (%) Green (%) Blue (%) Cover image 2.5(0.0) 2.4 (0.0) 2.6 (0.0) Product #1 10.6 (9.8)  13.3 (9.9)  12.4 (9.8) Product #2 13.4 (10.2) 11.4 (10.2) 10.3 (10.2) Product #3 12.9 (10.0)13.8 (10.1) 13.0 (10.0)

For the second test image, we used a 24-bit color photograph originallystored in JPEG format, taken by the Kodak DC260 digital camera (originalresolution 1536×1024) and cropped to 1024×744 pixels. In it we embeddeda very short message of length 5% (100%=3 bpp). The results shown inTable 3 demonstrate the extraordinary accuracy of the RS Steganalysis ofthe present invention.

TABLE 3 Initial bias and estimated number of pixels with flipped LSBsfor the second test image. Red (%) Green (%) Blue (%) Cover image 0.00(0.00   0.17 (0.00) 0.33 (0.00) Product #1 2.41 (2.44) 2.70 (2.46) 2.78(2.49) Product #2 2.45 (2.45) 2.62 (2.43) 2.75 (2.44) Product #3 2.44(2.46) 2.62 (2.46) 2.85 (2.45)

The novel technique of the present invention contradicts any rigorousattempt to detect Least Significant Bit steganography. See R.Chandramouli and N. Memon, “Analysis of LSB based Image SteganographyTechniques” to be published in the Proceedings of ICIP 2001,Thessaloniki, Greece, Oct. 7-10, 2001. This paper introduces “the notionof steganographic capacity, that is, how many bits can we hide in amessage without causing statistically significant modifications? Ourresults are able to provide an upper bound on the this capacity.”Chandramouli and Memon determine that the upper bound for safe convertcommunication by LSB steganography is 44 bits per 64 pixels. In otherwords, they claim that a steganographic capacity of 44/64 bits per pixel(i.e., 0.6875 bits per pixel) or less is safe, because messages shorterthan that upper bound cannot be detected.

The present invention, however, reliably detects messages shorter than0.05 bits per pixel embedded in most cover images. For high qualityimages from a scanner or digital camera (the types most likely to beused for covert communication), even shorter messages (0.01 bits perpixel) can be reliably detected. Based on our experiments, we recommenda steganographic capacity of 0.005 bits per pixel as safe for LSBsteganography, because our technique cannot reliably detect messagesshorter than 0.005 bits per pixel. This upper bound is more than 100times smaller than the bound found by Chandramouli and Memon. Thus, wecan say that the present invention offers a 100-fold improvement overthe prior art. The prior art therefore teaches away from the presentinvention.

Having described preferred embodiments of the invention with referenceto the accompanying drawings, it is to be understood that the inventionis not limited to those precise embodiments, and that various changesand modifications may be effected therein by one skilled in the artwithout departing from the scope or spirit of the invention as definedin the appended claims.

1. A method for detecting least significant bit (“LSB”) embedding of amessage hidden in randomly scattered samples of an alleged cover image,comprising the steps of: dividing the alleged cover image into aplurality of disjoint groups of adjacent samples; defining adiscrimination function that assigns a real number to each member ofsaid plurality of disjoint groups, thereby capturing the smoothness ofeach of said groups; defining on said plurality of disjoint groups atleast one invertible operation that comprises a permutation of samplevalues, whereby values of said samples are invertibly perturbed by asmall amount; applying said discrimination function and said invertibleoperation to define in said plurality three types of sample groups,(R)egular, (S)ingular, and (U)nusable, each of said types being definedfor both positive and negative operations; plotting both positive andnegative R and S for said alleged cover image on an RS diagram;constructing four curves of said RS diagram and calculating theirintersections by extrapolation; and determining the existence ornonexistence of a secret message from said intersections.
 2. The methodof claim 1, further including the step, if said secret message isdetermined to exist, of estimating a length thereof.
 3. The method ofclaim 2, wherein each of said samples is a pixel value.
 4. The method ofclaim 3, wherein said pixel value is a grayscale.
 5. The method of claim3, wherein said pixel value is a color.
 6. The method of claim 2,wherein each of said samples is an index to a palette of color values.7. The method of claim 1, wherein said step of constructing furthercomprises arithmetically averaging the x coordinates of saidintersections, thereby detecting said hidden message, if it exists, andestimating a length thereof.
 8. The method of claim 2, wherein said stepof estimating further comprises determining a length p of said hiddenmessage, if it exists, by rescalingthe x-axis of said RS diagram so thatp/2 becomes 0 and 100−p/2 becomes 1, whereby an x-coordinate of anintersection is a root of the following quadratic equation:2(d₁+d₀)x²+(d⁻⁰−d⁻¹−d₁−3d₀)x+d₀−d⁻⁰=0, where d₀=R_(M)(p/2)−S_(M)(p/2),d₁=R_(M)(1−p/2)−S_(M)(1−p/2), d⁻⁰=R_(−M)(p/2)−S_(−M)(p/2),d⁻¹=R_(−M)(1−p/2)−S_(−M)(1−p/2), and said message length p is calculatedfrom the root x whose absolute value is smaller,p=x/(x−½).
 9. Apparatus for detecting least significant bit (“LSB”)embedding of a message hidden in randomly scattered samples of analleged cover image, which comprises: means for dividing said allegedcover image into a plurality of disjoint groups of adjacent samples;first means for defining effective for defining a discriminationfunction that assigns a real number to each member of said plurality ofdisjoint groups, thereby capturing the smoothness of each of saidgroups; second means for defining effective for defining on saidplurality of disjoint groups at least one invertible operation thatcomprises a permutation of sample values, whereby values of said samplesare invertibly perturbed by a small amount; means for applying saiddiscrimination function and said invertible operation to define in saidplurality three types of sample groups, (R)egular, (S)ingular, and(U)nusable, each of said types being defined for both positive andnegative operations; means for plotting both positive and negative R andS for said alleged cover image on an RS diagram; means for constructingfour curves of said RS diagram; means for calculating the intersectionsof said four curves by extrapolation; and first means for determiningeffective for determining from said intersections the existence ornonexistence of a secret message.
 10. The apparatus of claim 9, furtherincluding means for estimating a length of said secret message if saidsecret message is determined to exist.
 11. The apparatus of claim 10,wherein each of said samples is a pixel value.
 12. The apparatus ofclaim 11, wherein said pixel value is a grayscale.
 13. The apparatus ofclaim 11, wherein said pixel value is a color.
 14. The apparatus ofclaim 10, wherein each of said samples is an index to a palette of colorvalues.
 15. The apparatus of claim 9, wherein said means forconstructing and calculating is further effective for arithmeticallyaveraging the x coordinates of said intersections, thereby detectingsaid hidden message and estimating a length thereof.
 16. The apparatusof claim 10, wherein said means for estimating is effective fordetermining a length p of said hidden message by rescaling the x-axis ofsaid RS diagram so that p/2 becomes 0 and 100−p/2 becomes 1, whereby anx-coordinate of an intersection is a root of the following quadraticequation:2(d₁+d₀)x²+(d⁻⁰−d⁻¹−d₁−3d₀)x+d₀−d⁻⁰=0, where d₀=R_(M)(p/2)−S_(M)(p/2),d₁=R_(M)(1−p/2)−S_(M)(1−p/2), d⁻⁰=R_(−M)(p/2)−S_(−M)(p/2),d⁻¹=R_(−M)(1−p/2)−S_(−M)(1−p/2), and said message length p is calculatedfrom the root x whose absolute value is smaller,p=x/(x−½).
 17. A computer-readable storage medium embodying programinstructions for a method for detecting least significant bit (“LSB”)embedding of a message hidden in randomly scattered samples of analleged cover image, said method comprising the steps of: dividing saidalleged cover image into a plurality of disjoint groups of adjacentsamples; defining a discrimination function that assigns a real numberto each member of said plurality of disjoint groups, thereby capturingthe smoothness of each of said groups; defining on said plurality ofdisjoint groups at least one invertible operation that comprises apermutation of sample values, whereby values of said samples areinvertibly perturbed by a small amount; applying said discriminationfunction and said invertible operation to define in said plurality threetypes of sample groups, (R)egular, (S)ingular, and (U)nusable, each ofsaid types being defined for both positive and negative operations;plotting both positive and negative R and S for said alleged cover imageon an RS diagram; constructing four curves of said RS diagram andcalculating their intersections by extrapolation; and determining theexistence or nonexistence of a secret message from said intersections.18. The computer-readable storage medium of claim 17, said methodfurther including the step, if said secret message is determined toexist, of estimating a length thereof.
 19. The computer-readable storagemedium of claim 17, said method further including, in said step ofconstructing, arithmetically averaging the x coordinates of saidintersections, thereby detecting said hidden message, if it exists, andestimating a length thereof.
 20. The computer-readable storage medium ofclaim 17, said method further including, in said step of estimating,determining a length p of said hidden message, if it exists, byrescalingthe x-axis of said RS diagram so that p/2 becomes 0 and 100−p/2becomes 1, whereby an x-coordinate of an intersection is a root of thefollowing quadratic equation:2(d₁+d₀)x²+(d⁻⁰−d⁻¹−d₁−3d₀)x+d₀−d⁻⁰=0, where d₀=R_(M)(p/2)−S_(M)(p/2),d₁=R_(M)(1−p/2)−S_(M)(1−p/2), d⁻⁰=R_(−M)(p/2)−S_(−M)(p/2),d⁻¹=R_(−M)(1−p/2)−S_(−M)(1−p/2), and said message length p is calculatedfrom the root x whose absolute value is smaller,p=x/(x−½).
 21. A method for detecting embedding of a message hidden inscattered samples of an alleged cover image, comprising the steps of:dividing the alleged cover image into a plurality of disjoint groups ofsamples; defining a discrimination function that assigns a real numberto each member of said plurality of disjoint groups, thereby capturingthe smoothness of each of said groups; defining on said plurality ofdisjoint groups at least one invertible operation that comprises apermutation of sample values, whereby values of said samples areinvertibly perturbed by a small amount; applying said discriminationfunction and said invertible operation to define in said plurality atleast three types of sample groups, at least two of the types of samplegroups being usable, each of said usable types being defined for bothpositive and negative operations; analyzing a distribution of the atleast two usable types for both positive and negative operations forsaid alleged cover image with respect to a quantized spatial imagerepresentation; and determining the existence or nonexistence of asecret message from said distribution.
 22. The method of claim 21,further including the step, if said secret message is determined toexist, of estimating a length thereof.
 23. The method of claim 22,wherein each of said samples is a pixel value.
 24. The method of claim23, wherein said pixel value is a grayscale.
 25. The method of claim 23,wherein said pixel value is a color.
 26. The method of claim 22, whereineach of said samples is an index to a palette of color values.
 27. Themethod of claim 21, wherein method further comprises the steps of:applying said discrimination function and said invertible operation todefine in said plurality three types of sample groups, (R)egular,(S)ingular, and (U)nusable, each of said types being defined for bothpositive and negative operations; plotting both positive and negative Rand S for said alleged cover image on an RS diagram; constructing fourcurves constructing four curves of an RS diagram and calculating theirintersections by extrapolation; and arithmetically averaging the xcoordinates of said intersections, thereby detecting said hiddenmessage, if it exists, and estimating a length thereof.
 28. The methodof claim 22, wherein method further comprises the steps of: applyingsaid discrimination function and said invertible operation to define insaid plurality three types of sample groups, (R)egular, (S)ingular, and(U)nusable, each of said types being defined for both positive andnegative operations; plotting both positive and negative R and S forsaid alleged cover image on an RS diagram; constructing four curvesconstructing four curves of an RS diagram and calculating theirintersections by extrapolation; and wherein said step of estimatingfurther comprises determining a length p of said hidden message, if itexists, by rescaling the x-axis of said RS diagram so that p/2 becomes 0and 100−p/2 becomes 1, whereby an x-coordinate of an intersection is aroot of the following quadratic equation:2 (d ₁ +d ₀)x ²+(d ⁻⁰ −d ⁻¹ −d ₁ −3d ₀)x−d ⁻⁰ =0, where d ₀ =R _(M)(p/2)−S _(M)(p/2 ), d ₁ =R _(M)( 1−p/2 )−S _(M)( 1−p/2 ), d ⁻⁰ =R _(−M)(p/2)−S _(−M)(p/2 ), d ⁻¹ =R _(−M)( 1−p/2 )−S _(−M)( 1−p/2 ), and saidmessage length p is calculated from the root x whose absolute value issmaller,p=x/(x− 1/2 ).
 29. An apparatus for detecting embedding of a messagehidden in randomly scattered samples of an alleged cover representingperceptual data, comprising: an input for receiving perceptual data; aprocessor, adapted for processing the received perceptual data,implementing an algorithm as follows: dividing said alleged cover datainto a plurality of disjoint groups of adjacent samples; defining adiscrimination function that assigns a real number to each member ofsaid plurality of disjoint groups, thereby capturing the smoothness ofeach of said groups; defining on said plurality of disjoint groups atleast one invertible operation that comprises a permutation of samplevalues, whereby values of said samples are invertibly perturbed by asmall amount; applying said discrimination function and said invertibleoperation to define in said plurality at least three types of samplegroups, at least two of the types of sample groups being usable, each ofsaid usable types being defined for both positive and negativeoperations; analyzing a distribution of the at least two usable typesfor both positive and negative operations for said alleged cover withrespect to a quantized perceptual data representation; and determiningthe existence or nonexistence of a secret message from saiddistribution; and an output for presenting at least an indication of anexistence of the secret message in the received perceptual data.
 30. Theapparatus of claim 29, wherein the processor further estimates a lengthof said secret message if said secret message is determined to exist.31. The apparatus of claim 30, wherein each of said samples is a pixelvalue.
 32. The apparatus of claim 31, wherein said pixel value is agrayscale.
 33. The apparatus of claim 31, wherein said pixel value is acolor.
 34. The apparatus of claim 30, wherein each of said samples is anindex to a palette of color values.
 35. The apparatus of claim 29,wherein said algorithm further comprises the steps of: applying saiddiscrimination function and said invertible operation to define in saidplurality three types of sample groups, (R)egular, (S)ingular, and(U)nusable, each of said types being defined for both positive andnegative operations; representing both positive and negative R and S forsaid alleged cover on an RS diagram; constructing four curvesconstructing four curves of an RS diagram and calculating theirintersections by extrapolation; and arithmetically averaging the xcoordinates of said intersections, thereby detecting said hiddenmessage, if it exists, and estimating a length thereof.
 36. Theapparatus of claim 30, wherein said algorithm further comprises:applying said discrimination function and said invertible operation todefine in said plurality three types of sample groups, (R)egular,(S)ingular, and (U)nusable, each of said types being defined for bothpositive and negative operations; plotting both positive and negative Rand S for said alleged cover image on an RS diagram; constructing fourcurves constructing four curves of an RS diagram and calculating theirintersections by extrapolation; and wherein said step of estimatingfurther comprises determining a length p of said hidden message, if itexists, by rescaling the x-axis of said RS diagram so that p/2 becomes 0and 100−p/2 becomes 1, whereby an x-coordinate of an intersection is aroot of the following quadratic equation:2 (d ₁ +d ₀)x ²+(d ⁻⁰ −d ⁻¹ −d ₁ −3d ₀)x−d ⁻⁰ =0, where d ₀ =R _(M)(p/2)−S _(M)(p/2 ), d ₁ =R _(M)( 1−p/2 )−S _(M)( 1−p/2 ), d ⁻⁰ =R _(−M)(p/2)−S _(−M)(p/2 ), d ⁻¹ =R _(−M)( 1−p/2 )−S _(−M)( 1−p/2 ), and saidmessage length p is calculated from the root x whose absolute value issmaller,p=x/(x− 1/2 ).
 37. A computer-readable storage medium embodying programinstructions for a method for detecting embedding of a message hidden inscattered samples of an alleged cover image, comprising the steps of:dividing the alleged cover image into a plurality of disjoint groups ofsamples; defining a discrimination function that assigns a real numberto each member of said plurality of disjoint groups, thereby capturingthe smoothness of each of said groups; defining on said plurality ofdisjoint groups at least one invertible operation that comprises apermutation of sample values, whereby values of said samples areinvertibly perturbed by a small amount; applying said discriminationfunction and said invertible operation to define in said plurality atleast three types of sample groups, at least two of the types of samplegroups being usable, each of said usable types being defined for bothpositive and negative operations; analyzing a distribution of the atleast two usable types for both positive and negative operations forsaid alleged cover image with respect to a quantized spatial imagerepresentation; and determining the existence or nonexistence of asecret message from said distribution.
 38. The computer-readable storagemedium of claim 37 , said method further including the step, if saidsecret message is determined to exist, of estimating a length thereof.39. The computer-readable storage medium of claim 37 , said methodfurther comprising the steps of: applying said discrimination functionand said invertible operation to define in said plurality three types ofsample groups, (R)egular, (S)ingular, and (U)nusable, each of said typesbeing defined for both positive and negative operations; representingboth positive and negative R and S for said alleged cover image on an RSdiagram; constructing four curves constructing four curves of an RSdiagram and calculating their intersections by extrapolation; andarithmetically averaging the x coordinates of said intersections,thereby detecting said hidden message, if it exists, and estimating alength thereof.
 40. The computer-readable storage medium of claim 37 ,said method further comprising the steps of: applying saiddiscrimination function and said invertible operation to define in saidplurality three types of sample groups, (R)egular, (S)ingular, and(U)nusable, each of said types being defined for both positive andnegative operations; plotting both positive and negative R and S forsaid alleged cover image on an RS diagram; constructing four curvesconstructing four curves of an RS diagram and calculating theirintersections by extrapolation; and wherein said step of estimatingfurther comprises determining a length p of said hidden message, if itexists, by rescaling the x-axis of said RS diagram so that p/2 becomes 0and 100−p/2 becomes 1, whereby an x-coordinate of an intersection is aroot of the following quadratic equation:2 (d ₁ +d ₀)x ²+(d ⁻⁰ −d ⁻¹ −d ₁ −3d ₀)x−d ⁻⁰ =0, where d ₀ =R _(M)(p/2)−S _(M)(p/2 ), d ₁ =R _(M)( 1−p/2 )−S _(M)( 1−p/2 ), d ⁻⁰ =R _(−M)(p/2)−S _(−M)(p/2 ), d ⁻¹ =R _(−M)( 1−p/2 )−S _(−M)( 1−p/2 ), and saidmessage length p is calculated from the root x whose absolute value issmaller,p=x/(x− 1/2 ).